Source-linked AI summary
Gradient-Leakage Resilient Federated Learning
Wenqi Wei, Ling Liu, Yanzhao Wu, Gong Su, Arun Iyengar
TL;DR
Federated learning keeps client data local, but gradient leakage can expose that training data. The paper proposes per-example client differential privacy in Fed-CDP, with dynamic decay clipping as an optimization. Across the evaluated settings, Fed-CDP offers greater gradient-leakage resilience than Fed-SDP while maintaining competitive accuracy.
Problem
Gradient leakage can expose client training data from intercepted local updates, so federated learning's distributed data storage alone does not protect privacy.
Source: §I · p. 1Method
Fed-CDP adds DP-guided Gaussian noise to per-example gradients before local batch averaging, and Fed-CDP(decay) uses a dynamic decaying clipping bound.
Source: C. Fed-CDP: Per-example Client… · p. 4, §VI · p. 8Results
Fed-CDP outperforms Fed-SDP in resilience to all three gradient-leakage attack types while offering competitive accuracy.
Source: §VIII · p. 11Takeaways & Limitations
Dynamic decay clipping further improves Fed-CDP's accuracy and resilience by reducing the clipping bound as training progresses.
Source: §I · p. 1, §VI · p. 8
Abstract
from arXiv · showhide
Federated learning(FL) is an emerging distributed learning paradigm with default client privacy because clients can keep sensitive data on their devices and only share local training parameter updates with the federated server. However, recent studies reveal that gradient leakages in FL may compromise the privacy of client training data. This paper presents a gradient leakage resilient approach to privacy-preserving federated learning with per training example-based client differential privacy, coined as Fed-CDP. It makes three original contributions. First, we identify three types of client gradient leakage threats in federated learning even with encrypted client-server communications. We articulate when and why the conventional server coordinated differential privacy approach, coined as Fed-SDP, is insufficient to protect the privacy of the training data. Second, we introduce Fed-CDP, the per example-based client differential privacy algorithm, and provide a formal analysis of Fed-CDP with the $(\epsilon, \delta)$ differential privacy guarantee, and a formal comparison between Fed-CDP and Fed-SDP in terms of privacy accounting. Third, we formally analyze the privacy-utility trade-off for providing differential privacy guarantee by Fed-CDP and present a dynamic decay noise-injection policy to further improve the accuracy and resiliency of Fed-CDP. We evaluate and compare Fed-CDP and Fed-CDP(decay) with Fed-SDP in terms of differential privacy guarantee and gradient leakage resilience over five benchmark datasets. The results show that the Fed-CDP approach outperforms conventional Fed-SDP in terms of resilience to client gradient leakages while offering competitive accuracy performance in federated learning.
I. INTRODUCTION
Federated learning keeps training data on clients, but leaked gradients can enable reconstruction, membership, and attribute inference. The paper distinguishes three leakage settings and introduces Fed-CDP to address per-example leakage that per-client protections may miss.
I. INTRODUCTION
- Fed-CDP adds noise to per-example gradients during local training, targeting instance-level privacy beyond per-client update protection.The paper also analyzes privacy accounting and the privacy-utility trade-off, and proposes dynamic decay noise injection.Source: §I · p. 1
II. RELATED WORK
- Prior cryptographic methods protect communication, not client data before encryption or after server decryption; Fed-SDP adds noise to per-client updates.The paper says these approaches can fail against instance-level gradient leakage.Source: §II · p. 2
III. GRADIENT LEAKAGE THREATS
- Type-0 attacks target per-client updates at the server, type-1 attacks target completed local updates at a client, and type-2 attacks target per-example updates during training.The threat model assumes encrypted client-server messages and faithful client participation, while allowing unauthorized inference by the server or a client.Source: §III · p. 2
- Reconstruction attacks iteratively optimize dummy data to match observed gradients, and the illustrated type-2 attacks can succeed in fewer iterations with higher quality than types 0 and 1.The examples use patterned random initialization, an L2 loss, and L-BFGS; type-0/1 uses batched gradients while type-2 uses per-example gradients.Source: §III · pp. 2–3
IV. SOLUTION APPROACH
The solution section establishes the concepts and reference model, states the problem, and then presents Fed-CDP, its algorithm, privacy parameters, and configuration trade-offs.
IV. SOLUTION APPROACH
- The section moves from differential privacy concepts and the federated-learning reference model to the problem statement and Fed-CDP's algorithm, parameters, and configuration trade-offs.It treats both non-private and privacy-preserving federated learning.Source: §IV · p. 3
A. Preliminary Concepts and Reference Model
The section introduces differential-privacy mechanisms and accounting concepts, then describes the reference federated-learning workflow from client training through server aggregation.
A. Preliminary Concepts and Reference Model
- Differential privacy is defined for neighboring datasets differing by one example, and the Gaussian mechanism calibrates noise to function sensitivity.The section states a noise-scale condition for the Gaussian mechanism when 0 < ε < 1.Source: A. Preliminary Concepts and Reference… · p. 3
- Random subsampling provides privacy amplification, while composition and the moments accountant describe privacy guarantees across repeated or sampled mechanism use.The moments accountant passage conditions its bound on sampling rate q, iteration count T, and noise scale σ.Source: A. Preliminary Concepts and Reference… · p. 3
- Clients download the current global model, train locally for multiple iterations, and send updates; the server aggregates updates from participating clients to form the next global model.The reference model presents FedSGD and FedAveraging as aggregation methods and considers FedSGD without loss of generality.Source: A. Preliminary Concepts and Reference… · pp. 3–4
B. Problem Statement
Fed-SDP adds Gaussian noise to per-client updates at each round, but its protection depends on where noise is added and does not cover per-example leakage during local training.
B. Problem Statement
- Client-side Fed-SDP noise can impede type-0 and type-1 leakage from noisy updates, but server-side noise does not protect type-1 access to true local updates.The paper says noisy updates make reconstruction harder, especially over more federated-learning rounds.Source: B. Problem Statement · p. 4
- Fed-SDP remains vulnerable to type-2 attacks because noise added only to a completed per-client update does not protect per-example gradients exposed during local training.This gap motivates Fed-CDP's per-example client differential-privacy design.Source: B. Problem Statement · p. 4
C. Fed-CDP: Per-example Client Differential Privacy
Fed-CDP adds differentially private noise to each clipped per-example gradient before local batch averaging. Sanitization is repeated for every layer and local iteration, supporting instance-level privacy and resilience to the three leakage types.
C. Fed-CDP: Per-example Client Differential Privacy
- Fed-CDP clips and adds DP-guided Gaussian noise to per-example gradients before local batch averaging in every local iteration.Sanitization is performed layer by layer and repeated throughout local training.Source: C. Fed-CDP: Per-example Client… · pp. 4–5
- The clipping bound trades off noise variance against retaining informative gradients: large bounds can impair training, while small bounds can prune useful gradients.The paper uses C = 4 by default and also discusses a median-based bound or one based on the learning rate.Source: C. Fed-CDP: Per-example Client… · pp. 4–5
- With δ = 1e-5, σ = 6, and C = 4 as defaults, larger noise scale σ corresponds to lower accumulated privacy loss when δ is fixed.Client subsampling with replacement at probability q is used for privacy accounting with the moments accountant.Source: C. Fed-CDP: Per-example Client… · pp. 4–5
- Every layer’s per-example gradients must be clipped and sanitized at every local iteration because changing one layer’s computed gradient does not change the gradients of previous layers.The workflow clips each layer’s gradient by its L2 norm before adding Gaussian noise, then averages sanitized gradients for local SGD.Source: C. Fed-CDP: Per-example Client… · p. 5
- Immediate layerwise sanitization protects per-example gradients against type-2 leakage, while its effect across joint-training rounds also provides resilience to type-0 and type-1 leakage.Sanitization occurs as each layer’s gradient is computed, before it can be exposed at the client.Source: C. Fed-CDP: Per-example Client… · pp. 5–6
V. PRIVACY ANALYSIS
The privacy analysis treats Fed-CDP’s per-example protection alongside joint client-level privacy. It relates local client sampling to global data sampling to support privacy accounting over joint training.
V. PRIVACY ANALYSIS
- Fed-CDP protects at the instance level by applying per-example gradient clipping and Gaussian-noise sanitization, and at the client level through joint differential privacy.The analysis defines instance-level adjacency as inputs differing by one training example and client-level adjacency as inputs differing by one client’s update.Source: §V · p. 6
- Proposition 1 states that the probability of selecting a class globally matches its probability in the global data distribution.The paper uses this sampling equivalence to model local sampling with replacement as global data sampling and apply moments-accountant privacy spending.Source: §V · p. 6
- Joint differential privacy means other clients may collude and share information without learning a particular client’s private information.Fed-CDP uses the Billboard Lemma and treats the server’s differentially private global model as public information.Source: §V · p. 6
- Fed-SDP’s per-round clipping and noise protect at the client level, but do not explicitly provide instance-level client differential privacy.Local differential privacy is outside the paper’s scope because it does not guarantee differential privacy for the globally trained model.Source: §V · pp. 6–7
VI. PRIVACY-UTILITY TRADE-OFF ANALYSIS
The section analyzes how noise distortion affects training utility and introduces decaying clipping to track gradient sensitivity. Fed-CDP (decay) improves accuracy and gradient-leakage resilience over Fed-CDP at the same privacy spending.
VI. PRIVACY-UTILITY TRADE-OFF ANALYSIS
- Fed-CDP clips and adds noise to each selected client’s per-example gradients before local batch SGD, repeating this process across local iterations and training rounds.The process is applied to each of the selected Kt clients in each round.Source: §VI · p. 7
- Figure 3 reports mean gradient L2 norms for 100 MNIST clients at one local iteration; the decline indicates a shrinking confidence gap, while early gradients are more informative.Source: Figure 3 · p. 7, §VI · p. 7
- The analysis bounds parameter distortion so injected noise does not shift prediction away from the ground-truth class and impair training utility.The condition requires s(x, w(t)) − Lv||ξ||u ≥ 0.Source: §VI · p. 7
- Computing a utility-preserving noise bound is expensive, especially for deep models with many classes; the paper instead relates the class-loss gap to gradient L2 magnitude.Source: §VI · p. 7
- Fed-CDP (decay) improves accuracy and gradient-leakage resilience over Fed-CDP at the same privacy spending, using decaying clipping to track gradient sensitivity.The changing clipping bound reduces noise variance over training rounds and produces non-uniform privacy spending.Source: §VI · p. 8
VII. EXPERIMENTAL EVALUATION
The evaluation uses five benchmark datasets with dataset-specific client partitions and models. It measures validation accuracy, training cost, privacy spending, and resilience to three types of gradient leakage attacks.
VII. EXPERIMENTAL EVALUATION
- Evaluation spans MNIST, CIFAR10, LFW, Adult income, and breast cancer, using convolutional models for image datasets and a fully connected model for attribute datasets.The datasets use different train-validation splits and client data partitions.Source: §VII · p. 8
- The simulator varies total clients from 100 to 10,000 and selects 5%–50% of clients per round.Experiments run on an Intel i5-7200U CPU with an Nvidia GeForce 2080Ti GPU.Source: §VII · p. 8
- Evaluation measures validation accuracy, local-iteration time, privacy budget ε, and three attack outcomes: success, iterations to succeed, and reconstruction distance.Reconstruction distance is the root mean square deviation between reconstructed input and its private ground truth.Source: §VII · p. 8
A. Training performance Evaluation
Fed-CDP improves accuracy over Fed-SDP across client settings, while decay clipping further improves accuracy. Per-example gradient processing adds computation, and utility depends on clipping and noise settings.
A. Training performance Evaluation
- Fed-CDP consistently beats Fed-SDP in accuracy across K and Kt settings, while Fed-CDP(decay) improves it and reaches 0.9748 validation accuracy on MNIST.The comparison varies total clients and participating-client ratios.Source: A. Training performance Evaluation · p. 8, Table II · p. 9
- Although Fed-CDP adds per-example clipping and sanitization overhead, its absolute per-iteration time remains relatively low, and clipping decay adds negligible cost.The comparison is per local iteration per client.Source: A. Training performance Evaluation · p. 8, Table III · p. 9
- Best clipping bounds differ by dataset, and accuracy declines when clipping is too large or small or when excessive Gaussian noise is added.The reported high-accuracy clipping settings are C = 2 or 4 for MNIST, Adult, and Cancer, and C = 4 or 6 for LFW and CIFAR10.Source: A. Training performance Evaluation · p. 9, Table IV · p. 9
B. Privacy Evaluation
The privacy evaluation reports Fed-CDP privacy spending across datasets and shows how local training iterations affect accounting. It also compares client-level privacy with Fed-SDP.
B. Privacy Evaluation
- At δ = 1e-5 and L = 100, instance-level ε is 0.8227 for MNIST and CIFAR-10, 0.6356 for LFW, 0.2761 for Adult, and 0.1469 for Cancer.The reported dataset round counts are 100, 100, 60, 10, and 3, respectively.Source: B. Privacy Evaluation · p. 9, Table VI · p. 9
- With L = 1, clients spend a smaller ε than with L = 100 at the same round, but require more rounds to reach the same accuracy.The actual ε accumulates with the number of local iterations.Source: B. Privacy Evaluation · p. 9
- Fed-CDP’s client-level privacy follows from its instance-level privacy and provides joint differential privacy, while Fed-SDP accounting is unaffected by local iteration count.The comparison concerns L = 1 and L = 100 local iterations.Source: B. Privacy Evaluation · pp. 9–10
C. Gradient-Leakage Resiliency
The attack evaluation finds Fed-CDP resilient to three leakage types, while Fed-SDP remains vulnerable to type-2 leakage. In communication-efficient learning, decay clipping provides the strongest reported resilience.
C. Gradient-Leakage Resiliency
- Fed-CDP mitigates all three leakage types, whereas Fed-SDP remains vulnerable to type-2; Fed-CDP(decay) has the highest reported resilience.The attack evaluation uses MNIST and LFW and reports attack success, reconstruction distance, and attack iterations.Source: C. Gradient-Leakage Resiliency · p. 10
- With MNIST gradients compressed by up to 30%, non-private training and Fed-SDP may still leak, while Fed-CDP(decay) provides the highest type-2 resilience.The comparison is in communication-efficient federated learning.Source: C. Gradient-Leakage Resiliency · p. 10, Figure 5 · p. 10
VIII. CONCLUSION
The conclusion presents Fed-CDP as per-example client differential privacy and summarizes its threat analysis, privacy accounting comparison, and decay-clipping variant.
VIII. CONCLUSION
- The paper identifies three client gradient-leakage types and explains why conventional Fed-SDP can be vulnerable to instance-level attacks.The conclusion frames these as contributions of its per-example client differential privacy approach.Source: §VIII · pp. 10–11
- Fed-CDP is formally compared with Fed-SDP in privacy accounting, and its privacy-utility trade-off is analyzed.Source: §VIII · p. 11
- Fed-CDP(decay) uses dynamic decay clipping and is reported to improve accuracy and resilience over Fed-CDP; overall, Fed-CDP offers high resilience with competitive accuracy.The paper reports resilience against all three gradient-leakage types.Source: §VIII · p. 11